Late.sh – a command-line Clubhouse for computer people
late.sh
late.sh
If this affects you, make sure you connect with `ssh [pseudonymous name]@late.sh`.
That's just how SSH works. If you want to be pseudonymous, you should also generate a new key pair.
I know that. Just because SSH automatically sends my local $USER doesn't mean they have to report the value received in the SSH username automatically on the game platform to other users, without first having prompted me "your username has been reported as <greengreengrass>. Is it okay to show this?".
A simple flag in my user profile in the platform to say whether I've said that's okay or not.
Or instructions to advise people to choose their username /before/ first connect. These are reasonable, privacy-preserving things to call out in a good and user-friendly design.
# privacy
we store your key fingerprint, not the full public key.
no IP logging. no tracking. no analytics.
chat messages and game scores are stored in
postgres, tied only to your fingerprint.
don't trust us? use a throwaway key:
$ ssh-keygen -t ed25519 -f ~/.ssh/late_throwaway && ssh -o IdentitiesOnly=yes -i ~/.ssh/late_throwaway late.sh
generates a disposable key — zero risk, full experience
Another small personal gripe: I think you should either remove the 1 line copy/paste sh install on the homepage, or add a link to a git repo on the homepage. I know it's possible to view the sh by visiting it, but a raw text file doesn't give any info about contributors or development process. Current form of no git repo and copy/paste bash pipe on homepage feels like a dark pattern.
However, the sort of tools that generally provide it also generally have a GitHub link nearby to encourage reading/writing the source. That too is convenient and I generally like it. Seemed like a fair suggestion.
Is it about deceptive commands that look like they’ll do something different using weird characters to alter what commands run or something?
It's more of a "this is possible" than "this is a real concern", of course.
I think you must be mixing something up here. At least i would be very surprised to learn how pipes are that leaky over the wire. It would be very interesting. But i can't imagine how a remote would differentiate between curl and curl piped. And the article doesn't load unfortunately.
Maybe I’m not that clever but I can’t imagine at all how that would even be remotely possible. How would curl even know it’s being piped into something else? And if curl can’t know, how would the remote server know?
Send different response to browser vs curl, sure, that’s easy. But I’m saying download it to your local disk first, read it from there, then run your local copy, that you read. Don’t read it in the browser.
From the blog:
> Execution in bash is performed line by line and so the speed that bash can ingest data is limited by the speed of execution of the script. This means if we return a sleep at the start of our script the TCP send stream will pause while we wait for the sleep to execute. This pause can be detected and used to render different content streams.
> Unfortuneatly its not just a simple case of wrapping a socket.send("sleep 10") in a timer and waiting for a send call to block. The send and receive TCP streams in linux are buffered on a per socket basis, so we have to fill up these buffers before the call to send data will block. We know the buffer is full when the receiving client to replies to a packet with the Window Size flag set to 0 (Win=0 in wireshark).
Is this your server fingerprint?
ED25519 key fingerprint is SHA256:Tc7aeaaQulKJeF3C/zd2BKvq/KgaQTHyMPNa3s9K+aE.
Ctrl + O -> Move down to your theme. Helps with the default one being a bit chaotic
Thanks for whoever made this. This is rad and gives me hope for the old internet vibes.
Fantastic job mati!
At what point is it enough? If they use high contrast, large fonts, and translations for every language—including Swahili’s default Kiunjuga dialect, but fail to include the Kimvita, Kiamu, Kingwana, Chimiini, Bajuni, AND Comorian dialects, will they be accosted for saying “f off” to everyone speaking Swahili outside of Zanzibar?
One doesn't need to sacrifice aesthetics to make the design legible to an average user.
> At what point is it enough?
It depends on who your audience is. The more people you want to reach, the more you need to cater to everyone's needs. There are fundamental anti-patterns to avoid like writing with a dark font on a dark background.
Considering its branding is entirely centered on late night socialization, I feel low-contrast dark mode is precisely the aesthetic that fits its identity.
I think anyone with access to an LLM doesn't necessarily need the technical know-how. They can just ask as an extra step for a design check including text contrast.
> I feel low-contrast dark mode is precisely the aesthetic
Agreed, and I like it too, if legible.
Once you leak your public key it could be used to check if another server recognizes that leaked public key.
~/.ssh/id_ecdsa.pub
~/.ssh/id_ecdsa_sk.pub
~/.ssh/id_ed25519.pub
~/.ssh/id_ed25519_sk.pub
~/.ssh/id_xmss.pub
~/.ssh/id_dsa.pub
At the very bottom of the website they give you a command that would not leak your public keys.
`ssh-keygen -t ed25519 -f ~/.ssh/late_throwaway && ssh -o IdentitiesOnly=yes -i ~/.ssh/late_throwaway late.sh`
this would only send the late_throwaway public key
Whether that's a concern or not is an open question, of course.
To be clear, that's an honest question, not sarcasm of anything. I only assume I don't know about some corner case with SSH or something? Because we have those on our websites, they are supposed to be used to verify signatures, etc. How is publishing them bad?
It's up to you to decide if it's okay that you send a server provider (in this case late.sh) a bunch of your public keys which he could for example use to probe other servers to see if you have access to them.
Everyone has different opsec.
ssh-keygen -t ed25519 -f ~/.ssh/late_throwaway && ssh -o IdentitiesOnly=yes -i ~/.ssh/late_throwaway late.sh
[0] https://gist.github.com/dangeranger/4a00ae6bed3a733161ffa3a5...
I’m shocked to see that LORD can’t be used because of licensing. Legally I know that’s how it is, but it Just Feels Wrong(tm) that a popular game based on 9600baud phone modems is encumbered in the era of fibre, wifi, and smartphones
I built it with the same stack and around the same time as late.sh, which I used for some inspiration.
also, mlbt can be run locally as a TUI.
But, can you reason more about your intent with the tone of your comment?
Your site copy is great to the last drop.
Great submission.
It is? It’s just the usual LLM.
but someone still has to proof and tweak generated copy.
Someone cared about this page.
We do G, not H. C, D, E — plus an optional F.
No I, no J, no K — just an L into a W.
I would say the design is the most human thing about this page. (It has its charm somehow, even if it’s obviously “flavour of the week LLM design”. Also, I don’t think an LLM would choose colours so poorly unless nudged in that direction – accidentally, I suppose.)
Must be an inappropriate use of the robot!
Kind of exhausting.
If you think (or care), that the LLM wrote all of the subheaders, the category names etc, then you might be spending too much time focused on the wrong thing.
no passwords. no OAuth. no accounts.
your ssh key is your identity.
chats, scores, and streaks are tied to your public key fingerprint. same key, same data.
And what the fuck is OAuth? (Okay, this clearly is oriented at developers, but on its own the sentence just doesn’t make sense. For me as a user, what pain is removed by not having a “Sign in with GitHub” button? Why should I care?)
How about you tell me why you decided to do it that way:
all your data – chats, scores, streaks – is tied to your ssh public key.
no need to come up with a password or verify your email – just ssh in.
Now, for bonus points, there’s two obvious questions to answer:
• what do I do if I lose my SSH key?
• what do I do if I use more than one device?
(The obvious answers are “you can add other SSH keys in your account settings” and “you can add other SSH keys in your account settings”.)
---
Okay, one more, and then I need to go grab a beer.
a read-only peek at the TUI in your browser.
tab around, see what's inside.
no typing, no chat, no games — just a window
into a shared demo session.
for the real thing, `ssh late.sh`.
a read-only preview of late.sh in your browser.
poke around and see what's inside. `ssh late.sh` when you’re ready to chat and play.The goal of the lander is to get you to use the clubhouse.
Not get you to become a contributor, or intrigued/turned away by their stack choice.
PS You could also be a heathen, and use the same key across devices!
Yep! That’s the idea. When writing, think about what your users want to know. If there is some technical detail you want to clarify – show how it helps the user.
> use the same key across devices!
That’s easier for sure! But if I lose a device, revoking one key on every server/service is a PITA already, and reissuing and replacing it on every server and client is even more so. (Also, this wouldn’t work with HSM-backed key stores like https://github.com/maxgoedjen/secretive :-)
I don’t think anybody really cares, the reaction is because you praised some copy that was obviously written by an LLM and either not edited or barely edited.
Sometimes less is more.
Yes, we should all just throw LLM-generated copy out there with minimal effort. Then receive your praise for the effort and care put in XD
The fact you’re still trying to defend an indefensible position suggests you must be trolling. Or at least, I _hope_ you’re trolling ;)
I genuinely found the space cool, and modern in a good way.
Stuff like this has often been an “ugly“ aesthetic, with slapped together and or minimal scaffolding. Or started that way.
I thought it was more than enough for a social PoC, & hope it develops further.
LLM-driven PoC is common and normal these days (and I do it too). But praising the copy here is like praising stock photos.
^This didn’t feel like LLM to me.
& for the category descriptions, I’m used to way more convoluted word-choice places like…here, lol, so that didn’t stand out to me the way it did for everyone else.
Only the conciseness, the need-to-know.
"don't trust us? use a throwaway key"
was panning to add similar things into my own macOS[1] ssh app with persistent SSH server.
Anyway, with that critique aside, this is the coolest thing I've seen all quarter.
Your dark mode choice for your late night chat is appropriate, and good branding. If someone’s technically literate enough to engage with an SSH-based social network, then they should be capable of injecting user scripts, custom CSS, and/or deploying assistive browser extensions, OS settings, and screen readers.
If this were a website about cataract treatments or a Metamucil landing page, then it would be a bad design.
everyone has ssh installed by default
lot of vitriol in the comments. looks like a spectacularly put together BBS, to me. the tools are open-source and have some really fun looking value add, but no, i haven't ran them.
Your tone in this comment is a bit out of place on HN. Why are you here if you think it's 1M dummies?
does not mean he should talk that way about people who have less knownledge